Access Control

SSoT for authority in the deployed contract set: principals, what each may do, and how long each action takes to become executable. Residual power is fail-closed: a hostile guardian can stop the protocol indefinitely while never moving value or widening a bound. Per-role detail lives in the children: Deployer, Admin, Risk Steward, Guardian, Mark Relayer, Treasury. Live addresses: Contract Addresses.

1. Principals

Roles are bits of one perms word per address: bits 0-15 are the instant per-leg gate lanes, 16 keeper, 17 guardian, 18 risk steward. There is no PAUSER_ROLE. setPerms(who, mask, on) grants lanes and the keeper bit instantly and clears any bit instantly; a risk-steward grant, and a guardian grant once armed, queue at LISTING (queueRole → executeRole). Once armed, removing the last guardian queues at GOVERNANCE (GUARDIAN_REVOKE).

One governance principal. Pool deployment is owner-gated: PoolFactory.createPool is onlyAdmin and resolves to the chain’s single AccessControl.owner(), because every pool reservation shares one CREATE3 namespace (the factory is the CREATE3 sender), so any other caller could spend a mined reservation on a pool of its own. The owner names each pool’s admin seat in the initdata it passes; seat 0 is the protocol sentinel resolving back to AccessControl.owner(). AccessControl.Role is exactly NONE (0), FACTORY (1), TREASURY (2), OWNER (3), RISK_STEWARD (4), GUARDIAN (5), GUARDIAN_REVOKE (6). The treasury is a pointer the owner rotates, not a principal (Treasury).

Ownership handover and the transferOwnership / renounceOwnership reverts: Admin.

1.1. Arming the quorum policy

AccessControl.armQuorumPolicy(guardians) is a one-way latch: callable once, by the owner, never unset. It refuses to arm unless every condition below already holds, so arming asserts that the deployment is production-shaped; it does not make it so.

After arming, an instant guardian clear reverts ThresholdViolation once it would drop guardianCount to zero, and every newly granted guardian must pass the quorum check.

There is no on-chain monitoring view for this. A multisig that lowers its own threshold post-arm is invisible to every on-chain gate; the residual is detectable only off-chain, by reading getOwners() / getThreshold() against QuorumLib.admin(n) directly.

2. Halt authority

Halt is immediate (no timelock). On a pool without a seated admin, release is owner-only.

One asset-level lever. haltAsset(pool, token, HALT_BIT) sets bit 0 of Asset.flags (layout: Guards §1); unhaltAsset(pool, token, HALT_BIT) clears it. Who may clear it is the table above; the seat’s side: Pool Deployment & Curation §2. The other levers above act on an oracle lane or an upgrade request, not on an asset.

A queued timelock (MIGRATE_BASE_TOKEN / setBaseToken included) is not a pause.

Depeg is one trigger among many; its detection and auto-halt path is Flow Guards.

2.1. Escalation

Confirm the wallet’s chain before sending: Guardian Routines §1.

2.2. Fleet sweep

2.3. Contact

security@btr.markets (reasonable-best-efforts).

3. Timelock parameters

Timelock durations SSoT. The whole fleet’s schedule is one deploy-time word: up to 8 tiers x uint32 seconds, indexed by ConstantsLib.Tier (3 members), passed to the AccessControl constructor and exposed as the immutable AccessControl.GOV_DELAYS(). Every governed contract (Admin, PoolFactory, Flash, the mark store logic) derives its own tier delays from that word at construction via ConstantsLib.delayOf(schedule, tier). No setter, no proxy: the word cannot change after construction, owner included. Nothing branches on block.chainid.

Production passes ConstantsLib.PROD_DELAYS, the schedule below. No zero-delay schedule exists: the deploy path rejects any schedule whose smallest tier delay is below ConstantsLib.MIN_ARMED_DELAY_SECS (1 h), and ConstantsLib.sol marks ZERO_DELAYS as not deployable. Public testnets pass ConstantsLib.TESTNET_DELAYS.

Tiers split by what an op changes: structure (code, who governs, protocol money, re-rooting) waits a week, listing and pricing waits a day, bounded numbers wait an hour. Direction splits them again: a risk-reducing steward write executes instantly and unbounded, while the same field in the loosening direction keeps its tier (Parametrization §2). TUNING does not scale with the deployment: one hour is MIN_ARMED_DELAY_SECS, the floor the timelock arms at. Risk parameters are bounded by PoolConfigLib constants at execute, so the delay is a public review window and not the safety property. De-risking stays instant on every tier: halt, tighten, cancel, unhalt and unpause live outside the schedule.

4. Owner-gated op classes

Every pool op queues through one generic entrypoint, requestOp(pool, uint8 opType, bytes32 subject, bytes payload), and cancels through one, cancelOp(pool, opType, subject). opType is the IPool.OpType enum ordinal, so the declaration order below is load-bearing for any caller encoding a uint8:

enum OpType {
    NONE,                 // 0
    MIGRATE_BASE_TOKEN,   // 1
    UPDATE_ANCHOR,        // 2
    UPDATE_TREASURY,      // 3
    UPDATE_HOOK,          // 4
    ADD_ASSET,            // 5
    UPDATE_RISK,          // 6
    UPDATE_FEES,          // 7
    UPDATE_PROFILE,       // 8
    UPDATE_CURVE,         // 9
    UPDATE_ASSET_PARAMS,  // 10
    SWEEP,                // 11
    BACKFILL_LEGS,        // 12
    UPDATE_POOL_ADMIN     // 13
}

requestOp selects the tier from one exhaustive table and reverts InvalidInput on any value that table does not name; there is no default arm that would hand an unknown op the shortest delay. Execute is one named function per op. Entry points on Admin unless noted.

There is no oracle repoint op. Each leg names a lane of the chain’s one mark store, which lives in the Pool implementation; the store changes only with the fleet upgrade (GOVERNANCE), and a feed id maps to its lane through PoolFactory.setFeedLane.

Two owner levers in the Immediate row bypass Admin and its timelock entirely. Neither is a pool-param write:

• Pool.adminSetDeadSeedPow10(token, pow10) is gated directly on AccessControl.owner(), not on the Admin singleton. It sets the dead-seed exponent used to price the first depositor’s index pin, is bounded at decimals + 3, and takes effect only while the leg is still unseeded.
• PoolFactory.deregisterPool(pool) evicts a pool from every discovery index. It is the delisting lever for a retired or misconfigured deployment; it does not touch the pool’s funds or its ability to trade.

UPDATE_ASSET_PARAMS (ordinal 10) is absent from that table and cannot be passed to requestOp; the call reverts.

Whether a params write queues or applies instantly is the defensive-tighten policy, decided inside requestAssetParams, the only entrypoint that may queue one. It writes immediately before bootstrapSealed[pool] or on a defensive tighten, and otherwise queues itself at TUNING for executeUpdateAssetParams.

Any minLiquidity change queues in either direction. A raise halts outflow instantly while its reversal would wait out the TUNING delay (1 hour under PROD_DELAYS), and haltAsset already covers that need on both edges.

RiskConfig follows the same asymmetry: setRiskConfigTighten lands now, every other direction is a queued UPDATE_RISK. So does the quiet-tape band: raiseMinDispersion lands now at the leg’s live curveId, a cut and every curve move queue on UPDATE_PROFILE (Admin §5.3).

5. Upgrade sequence

1. Queue: PoolFactory.requestReferenceUpgrade, or requestUpgrade on Admin / Flash
2. Wait the GOVERNANCE tier delay (7 d under PROD_DELAYS)
3. Execute inside GRACE_PERIOD_SECS or request expires
4. Cancel anytime before execute (cancelReferenceUpgrade / cancelUpgrade): owner or guardian

PoolFactory.upgradeTimelock is the eta of the pending upgrade, not a configured delay: it reads zero when nothing is queued, and the notice period is the immutable DELAY_UPGRADE (GOVERNANCE tier).

The fleet upgrade migrates the mark store into the new implementation, then calls upgradeTo on every pool proxy; one failure reverts it all. Procedure: Admin.

6. Oracle push roles

Signers are a committed roster per tier on the mark store and authorize by signature. publishMarks is the only mark path; the relayer that lands a segment must be on the tier’s relayer list and holds no price authority, only choice of when a validly signed segment lands, within 120 s of its source second. Roster, quorum and relayers change together through setAuth at GOVERNANCE; the instant lever is the lane halt. Full ceremony and constants: Mark Relayer.

7. Related